jspreadsheet / jspreadsheet/ce

eval() used for formula dependency-token type checking in index.js (bundler flags it, and it's built from parsed formula tokens)

Open
#1,805 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
7.2k
Forks
890
PR merge metrics
No merged PRs in 30d

Description

Version: 5.0.4 (node_modules/jspreadsheet-ce/dist/index.js)

Description:

The formula dependency tracker uses a direct eval() call built from string concatenation of a parsed formula token:

// dist/index.js:571
for (let i = 0; i < tokens.length; i++)
    if (
        obj.formula[tokens[i]] || (obj.formula[tokens[i]] = []),
        obj.formula[tokens[i]].indexOf(parentId) < 0 && obj.formula[tokens[i]].push(parentId),
        eval("typeof(" + tokens[i] + ") == \"undefined\"")
    ) {

Modern bundlers (Vite/Rollup in my case) flag this explicitly:

[EVAL] Use of direct `eval` function is strongly discouraged as it poses security risks and may cause issues with minification.

Reproduction: any Vite (or other Rollup-based) build of a project depending on jspreadsheet-ce with formula support in use will surface this warning at build time, pointing at this exact line.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at node_modules/jspreadsheet-ce/dist/index.js around line 571, where formula dependency tokens are type-checked with eval(). Reproduce the Vite or Rollup build described in the issue and trace the surrounding formula dependency logic. Done means the bundler warning is gone while formula support and dependency tracking still work.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.